CVE-2004-0842

published 2004-12-23

CVE-2004-0842: Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory…

high 7.5 CVSS 3.1

AV N AC L Au N C P I P A P

EXPLOIT

Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."

Affected

6 ranges

Vendor	Product	Version range	Fixed in
avaya	modular_messaging_message_storage_server	—	—
avaya	modular_messaging_message_storage_server	—	—
microsoft	ie	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—